Aave, Kelp, Lido weigh Layer-2 bailout after rsETH theft

An attacker withdrew 116,500 rsETH — roughly $292 million at current prices — from KelpDAO’s cross-chain bridge on April 18. The exploit left a large, concentrated rsETH position on Layer 2 and exposed lenders and vaults to potential losses.

Aave, KelpDAO and Lido are exploring plans to contain losses on Layer 2. People familiar with private talks said options under discussion include raising capital and limited loss-sharing arrangements that would keep the impact off Ethereum mainnet. One scenario under consideration would raise about 110,000 ETH to cover the shortfall.

Aave faces heavy exposure because about 86% of all rsETH is supplied on its protocol. High concentration on Aave means any contagion that reaches Layer 1 could affect large amounts of capital. Participants in the talks described mounting pressure to act because negative yields on some vaults are generating substantial daily losses; one person involved estimated the drain at more than $100,000 a day for some positions. The EarnETH vault holds a levered rsETH/ETH position on Aave that represents about 9% of the vault, roughly $21.6 million.

Market conditions on lending markets have tightened. High utilization has increased costs for margin and other leveraged positions and raised the stakes for lenders and vaults during the resolution process. People familiar with the situation said a targeted haircut for certain user segments remains a fallback option rather than a decided plan.

Lido paused deposits and withdrawals on its EarnETH vault while it assesses the rsETH exposure and possible recovery paths. Lido’s vault includes a $3 million first-loss protection fund supplied from the DAO treasury, which can be used via burning the DAO’s vault shares. Lido officials said withdrawals could reopen with the rsETH position marked to a maximum expected haircut so depositors could exit at a known worst-case value. Lido’s stETH and wstETH balances and the core staking protocol are not affected.

LayerZero publicly reported preliminary indicators that point to a state-linked actor, naming a DPRK-linked group known as Lazarus and a cluster called TraderTraitor as likely culprits and linking the incident to KelpDAO’s single-DVN configuration. Other possibilities floated in private discussions included a long-running system compromise or an insider action; those theories remain unconfirmed.

KelpDAO is weighing legal and fundraising responses. Private talks among ecosystem participants have included debates over who should absorb losses and how quickly funds must be raised. One participant summarized the preference in the talks as “L2 localised.” For now, participants describe an impasse; they expect a decision in the near term as market and protocol mechanics push toward a resolution.